[CAS 7.2.2] Device Code Authorization Returning Device Code

[Anthony Heng]

Hi,

I am designing a system to following the RFC 8628 device authorization flow, but the resulting access token ends up being linked to an anonymous user rather than the openid profile for login. 

I am using the endpoints at https://apereo.github.io/cas/7.3.x/authentication/OAuth-ProtocolFlow-DeviceAuthorization.html (this is equivalent to the previous 7.2.x docs) and I perform the following steps:

1. Request a device code, user code, and verification uri from /oauth2.0/accessToken, parameters including client_id=<CLIENT_ID>&response_type=device_code&scope=openid+profile+email+groups
2. The verification uri always leads to /oauth2.0/device, which I open in a web browser, log in with my username/password. Leads to a page to enter the user code which I do. 
3. loop to perform a GET request at  /oauth2.0/accessToken with the previous parameters, in addition to the device_code until it returns a successful 200 response with the access token. 

I successfully obtain an access token, however this token is not linked to the openid profile of the user who logged in at the verification uri. On top of this, it seems like the scopes haven't been properly set either from introspection/ oauth2 profile response:

Introspection: 
{'token': <access token>, 'active': True, 'sub': 'anonymous', 'scope': 'CAS', 'iat': 1784160386, 'exp': 1784189186, 'uniqueSecurityName': 'anonymous', 'tokenType': 'Bearer', 'aud': <client_id>, 'client_id': <client_id>, 'grant_type': 'urn:ietf:params:oauth:grant-type:device_code', 'cnf': {}}

/oidc/oidcProfile :
{'sub': 'anonymous', 'service': <service_id>, 'attributes': {'authenticationDate': '2026-07-16T00:06:26.565966986Z', 'grant_type': 'urn:ietf:params:oauth:grant-type:device_code', 'client_id': <client_id>}, 'id': 'anonymous', 'client_id': <client_id>}

For the relevant logs, it seems like the request isn't receiving my required scopes either which I suspect is the case, but considering other authentication flows work (e.g. legacy username/password) I'm not sure why.

After requesting device code:
WHAT: {code=N/A, grant_type=urn:ietf:params:oauth:grant-type:device_code, service=<service_id>, scope=[]
, response_type=device_code, redirect_uri=null, client_id=null}
ACTION: OAUTH2_ACCESS_TOKEN_REQUEST_CREATED
...

>
2026-07-16 10:15:31,958 INFO [org.apereo.inspektr.audit.AuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHEN: 2026-07-16T00:15:31.958294990
WHO: audit:unknown
WHAT: {user_code=<user code>, device_code=<device code>, interval=15, verification_uri=https://cas.example.org/oauth2.0/device, expires_in=300}
ACTION: OAUTH2_ACCESS_TOKEN_RESPONSE_CREATED



After device code is entered:
WHAT: {code=N/A, grant_type=urn:ietf:params:oauth:grant-type:device_code, service=<service id>, scope=[]
, response_type=device_code, redirect_uri=null, client_id=null}
ACTION: OAUTH2_ACCESS_TOKEN_REQUEST_CREATED
...

>
2026-07-16 10:10:58,289 DEBUG [org.apereo.cas.authentication.CoreAuthenticationUtils] - <Merged attributes with the final result as [{grant_type=[urn:ietf:p
arams:oauth:grant-type:device_code], scope=[], client_id=[<client_id>]}]>
2026-07-16 10:10:58,291 INFO [org.apereo.inspektr.audit.AuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHEN: 2026-07-16T00:10:58.291001580
WHO: audit:unknown
WHAT: {access_token=<access_token>, token_type=Bearer, expires_in=28800}
ACTION: OAUTH2_ACCESS_TOKEN_RESPONSE_CREATED


So I am wondering: am I missing something from this flow in order to properly establish the link? Or is this likely a misconfiguration and if so what could it be and what class should I trace to determine what the misconfiguration is?

Kind Regards,

Anthony Heng

[Anthony Heng]

Upgraded to 7.3.8: The same issue persists.